{"id":"MAL-2026-17455","summary":"Malicious code in dedh-devops-automation (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (e623272b4de65cc8af24a44d5405d9f6baa2c42896b50f9b7e0e5f294bfd2722)\nDuring installation, the package deploys a rogue AWS Lambda function to collect credentials from Secret Manager as well as collect other data. Data are then exfiltrated.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-10-spo365-graph\n\n\nReasons (based on the campaign):\n\n\n - The package overrides the install command in setup.py to execute malicious code during installation.\n\n\n - exfiltration-cloud-tokens\n\n\n - exfiltration-credentials\n\n\n - targetted-attack\n","modified":"2026-10-02T17:00:04.936482195Z","published":"2026-10-02T14:10:14Z","database_specific":{"malicious-packages-origins":[{"id":"pypi/2026-10-spo365-graph/dedh-devops-automation","import_time":"2026-10-02T14:21:00.431320376Z","modified_time":"2026-10-02T14:10:14.267008Z","sha256":"e623272b4de65cc8af24a44d5405d9f6baa2c42896b50f9b7e0e5f294bfd2722","source":"kam193","versions":["0.0.1","5.0.0","5.6.0","5.6.1","5.6.999","5.8.0","5.8.1","5.9.0"]},{"id":"pypi/2026-10-spo365-graph/dedh-devops-automation","import_time":"2026-10-02T14:45:41.977903544Z","modified_time":"2026-10-02T14:41:23.762563Z","sha256":"0d8463c1c6322e355195f7692923e5cb21465185f8df271cd8b21edb3f5242f0","source":"kam193","versions":["0.0.1","5.0.0","5.6.0","5.6.1","5.6.999","5.8.0","5.8.1","5.9.0"]},{"id":"pypi/2026-10-spo365-graph/dedh-devops-automation","import_time":"2026-10-02T15:19:27.45299298Z","modified_time":"2026-10-02T14:41:23.762563Z","sha256":"a911f6efc01eb7a5eb4a1d04d7135d846ba21b6d0926cb51e8274fdab6896709","source":"kam193","versions":["0.0.1","5.0.0","5.6.0","5.6.1","5.6.999","5.8.0","5.8.1","5.9.0"]},{"source":"kam193","versions":["0.0.1","5.0.0","5.6.0","5.6.1","5.6.999","5.8.0","5.8.1","5.9.0"],"id":"pypi/2026-10-spo365-graph/dedh-devops-automation","import_time":"2026-10-02T16:20:44.041558225Z","modified_time":"2026-10-02T15:41:38.822027Z","sha256":"66e3f78c24074409feb667c7c3735c8cc99dea2adc35ff0151e12b3dfbcbc7a5"},{"id":"pypi/2026-10-spo365-graph/dedh-devops-automation","import_time":"2026-10-02T16:45:36.201548518Z","modified_time":"2026-10-02T16:38:17.158911Z","sha256":"0d56149d9c6ccbb8dbc39de2b3501bdec1b99071ce70a9649176c0202fb18921","source":"kam193","versions":["0.0.1","5.0.0","5.6.0","5.6.1","5.6.999","5.8.0","5.8.1","5.9.0"]}],"iocs":{"urls":["https://catdig-azdo-cfn-platform-bravo-prod-us-east-2.s3.amazonaws.com/cfn-artifacts/platform-bravo-api-health-check.json"]}},"references":[{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/dedh-devops-automation"}],"affected":[{"package":{"name":"dedh-devops-automation","ecosystem":"PyPI","purl":"pkg:pypi/dedh-devops-automation"},"versions":["0.0.1","5.0.0","5.6.0","5.6.1","5.6.999","5.8.0","5.8.1","5.9.0"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/dedh-devops-automation/MAL-2026-17455.json"}}],"schema_version":"1.9.0","credits":[{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"}]}